Method and device for controlling an aircraft manoeuvring components, with electrical standby modules

ABSTRACT

Device for controlling aircraft maneuvering units including:  
     at least one control unit, which may be actuated by a pilot for issuing maneuvering commands,  
     a central computing unit ( 20 ) capable of establishing control signals for at least one maneuvering unit from said maneuvering commands, each central computing unit being provided with its own failure detection system.  
     According to the invention, the device further includes at least one backup electronic module ( 40 ) respectively associated with a maneuvering unit and capable of also establishing control signals for this maneuvering unit from said maneuvering commands, said electronic module lacking any failure detection system of its own, but being connected to a central failure detection system.

TECHNICAL FIELD

[0001] The present invention relates to a method and a device forcontrolling maneuvering units of an aircraft.

[0002] The invention finds applications notably in the secured controlof maneuvering units such as rudders, elevators, air-brake flaps,incidence-adjustable stabilizers as well as brake systems acting on thelanding gear, for example.

STATE OF THE PRIOR ART

[0003] On an aircraft, a certain number of maneuvering units areconsidered as critical in order to provide security on the course of thecraft, both on the ground and in flight. The control system for theseunits should have a high degree of reliability and availability. Inother words, the control should be protected even in the case of failureof one or more components of the system, in order to ensure at leastcontinuation of flight and landing.

[0004] For this purpose, at least one main control system and one backupcontrol system are generally associated with each critical maneuveringunit.

[0005] On a number of craft, an electrical main control system is used,associated with a mechanical backup system. For instance, this is thecase for aircraft of the Airbus A320, A330 or A340 type. On these craft,the backup control for the adjustable horizontal plane as well as forsteering is of the mechanical type. More specifically, electrical inputactuators drive the mechanical inputs of actuators associated with theadjustable horizontal plane, and of steering actuators, via a linkagesystem.

[0006] In addition to the lack of accuracy from which might suffer acontrol including a linkage system, mechanical controls require frequentmaintenance in order to ensure the absence of any hidden failure.

[0007] On the aircraft of the aforementioned type, there is also abackup control of the hydraulic type used for the braking system. In thebackup braking system, the brake pedals, which may be actuated by thepilot, act on master cylinders which control the brake shoes via a lowpressure hydraulic circuit.

[0008] Such a backup system is not free from any damage such as a leakof the hydrostatic transmission and therefore also requires frequentchecking. In order to avoid the constraints of mechanical or hydraulicbackup control systems, an electrical backup control may also beprovided. As an example, on the A320, A330 and A340 aircraft mentionedearlier, transmission of steering commands between the steering unit andthe control surface actuators is provided via a plurality of computers.The computers are part of two computing units called primary andsecondary units, one of which may be considered as a backup unit. Thecomputers of both computing units are of different design and origin inorder to reduce the risk of a design error common to both units.

[0009] Each computer is designed in order to be able to detect by itselfany fault which would affect its own operation. For this purpose it hasa duplex structure of the control/monitoring type, with a control linewhich establishes control signals for the actuators of control surfacesand a monitoring line which monitors the control line. In the case ofany disagreement between both lines, the corresponding computing unitassumes an inactive state so that the second computing unit may assumecontrol of the control surfaces.

[0010] Document FR-A-2593774 describes a control device of a controlsurface wherein the traditional mechanical backup control is replaced byan electro-optical backup system. In this device, the operation of thebackup system is independent of the main electrical control system.However, it is not active in the case of normal operation of the mainsystem.

[0011] In order to guarantee proper operation of such a device, twosolutions are may be contemplated a priori. As the backup system is notactive in normal flight, a first solution consists of performing regulartests on the ground, notably during maintenance services. A secondsolution, retained in the document, consists of providing the backupsystem with a duplex structure as described earlier, i.e., a structureof the control/monitoring type. Thus, in the case of a failure of thecontrol channel of the backup system, the fault may be detected by themonitoring channel of the backup system.

[0012] The second solution enables any failure of the backup controlsystem to be detected in flight, but increases its complexityconsiderably.

[0013] Generally, control devices known in the state of the art, havedifficulties related to reliability and/or maintenance requirements ofthe backup control systems. These difficulties are overcome at leastpartly, by providing each backup system with a structure enabling itsown self-contained control in flight. However, such structures are veryexpensive and complex.

DISCUSSION OF THE INVENTION

[0014] The object of the invention is to provide a method and a devicefor controlling maneuvering units, for an aircraft, which do not havethe difficulties mentioned above.

[0015] In particular, one object is to provide such a device whichenables a high level of reliability to be attained whilst having arelatively simple and not very expensive structure as compared withknown devices.

[0016] Another object is to guarantee proper operation of the devicewhile avoiding ground test and maintenance procedures for backupcontrols.

[0017] Finally, one object is to preserve large autonomy of the main andbackup controls.

[0018] In order to achieve these objects, the invention morespecifically relates to a device for controlling maneuvering units of anaircraft including:

[0019] controlling means, which may be actuated by a pilot for issuingmaneuvering commands,

[0020] at least one central computing unit capable of establishingcontrol signals for at least one maneuvering unit from said maneuveringcommands, each central computing unit being provided with its ownfailure detection system.

[0021] According to the invention, the device further includes at leastone electronic module associated with a maneuvering unit, and capable ofalso establishing control signals for this maneuvering unit from saidmaneuvering commands. The electronic module lacks any failure detectionsystem of it own, but is connected to a central system for detectingfailures.

[0022] Each electronic module is preferably associated with a singlemaneuvering unit, but may be associated with several maneuvering units.

[0023] The term “maneuvering unit” means any unit capable of steeringthe course of the aircraft in flight or on the ground. In particular,these are units such as mobile surfaces or braking mechanisms.

[0024] As the local electronic modules lack any failure detectionsystems of their own, they may have a simplified structure as comparedwith traditional backup systems. The existence of a central failuredetection system, which may be common to a large number of backupmodules, allows them to be relieved from the requirements of properoperation tests performed on the ground.

[0025] In a particular embodiment, the central computing unit isprogrammed in order to establish the control signals according to a law,a so-called elaborate law, and each electronic backup module isprogrammed according to at least one law, a so-called simplified law,different from the elaborate law and simpler than the latter.

[0026] The electronic modules which may elaborate control signalsaccording to simple proportional laws for example, have a particularlyreduced size. They may then easily be distributed within the aircraft,according to the maneuvering units which they control, for example nearthe actuators of these units.

[0027] The central computing unit may optionally be intended for asingle maneuvering unit, however, in a preferred embodiment of theinvention, the central unit is associated with a plurality of themaneuvering units of the aircraft or even all of them.

[0028] According to an advantageous enhancement of the invention, thecentral failure detection system may be one of the computers of thecentral computing unit. With this, the failure detection function may beachieved in a very economical way. In this case, the electronic modulesmay, for example, establish control commands without their beingdirected towards the actuators of the maneuvering unit during normaloperation of the central computing unit. However, established controlcommands may be forwarded to at least one of the computers of thecentral unit so that this computer may check compliance of thesecommands either continuously or not.

[0029] In order to increase the reliability of the central computingunit, the latter may include at least two redundant computers. Theredundant computers are preferably of different design and origin.

[0030] Moreover, the computers may have a duplex type structure by beingprovided with a first computing channel, called a control channel, andwith a second computing channel, called a monitoring channel. Themonitoring channel is a part of the own failure detection system of thecentral computing unit.

[0031] In order to prevent an operational perturbation from beingtransmitted over a possible link existing between the backup electronicmodules and the central computing unit, used as a failure detectionsystem for the modules, this link may include galvanic insulation meanssuch as opto-coupler means, transformer means, or filter means. The linkmay also be made with an optical fiber in order to avoid any electricalconnection between the modules and the central computing unit.Furthermore, it is possible to assign only one of the computers of thecentral computing unit to the detection of failures in the backupmodules, so that a possibly transmitted perturbation only affects thissingle computer. Another possible precaution finally consists inproviding an interruption in the monitoring of the backup electronicmodules during certain phases of flight such as taking-off or landing.

[0032] In particular, the device described above may be used forcontrolling at least one maneuvering unit selected from:

[0033] a control surface of the aircraft,

[0034] an adjustable inclined plane of the aircraft, and

[0035] a braking system of the aircraft.

[0036] The invention also relates to a method for controllingmaneuvering units of an aircraft which may be implemented by means ofthe described device. The method consists of:

[0037] establishing first control signals for a plurality of maneuveringunits by means of at least one central computing unit provided with itsown failure detection system,

[0038] establishing second control signals by means of a plurality ofbackup electronic modules associated with a plurality of maneuveringunits, respectively,

[0039] checking for proper operation of at least one computer of thecentral computing unit and forwarding first control signals tomaneuvering units when proper operation is ascertained, and

[0040] forwarding the second control signals to the maneuvering unitsassociated with the electronic modules, respectively when a malfunctionof the central computing unit is ascertained.

[0041] As mentioned earlier, checking for proper operation of theelectronic modules may be performed by a computer, preferably a singlecomputer from the central computing unit. Checking may be performedeither continuously or periodically.

[0042] Other features and advantages of the invention will becomeapparent from the description which follows with reference to thefigures of the appended drawings. This description is given as purelyillustrative and non-limiting.

SHORT DESCRIPTION OF THE FIGURES

[0043]FIG. 1 is a schematic illustration of a first exemplary embodimentof a device according to the invention, for controlling a rudder of anaircraft.

[0044]FIGS. 2, 3 and 4 are schematic illustrations of actuators whichmay be used with the control device according to the invention, forcontrolling maneuvering units.

[0045]FIG. 5 is a more detailed illustration of certain portions of thedevice of FIG. 1.

[0046]FIG. 6 shows another exemplary embodiment of the portions of thedevice of FIG. 1.

[0047]FIG. 7 is a schematic illustration of a second exemplaryembodiment of a device according to the invention.

[0048]FIG. 8 is a schematic illustration of an exemplary embodiment of adevice according to the invention applied to the control of a brakingsystem.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

[0049]FIG. 1 shows a device for controlling a control surface 10 whichmay be moved by three actuators 11, 12 and 13. The actuators, thestructure of which is described in more detail in the following text,are illustrated in a simplified way. They receive control signalsestablished by a central computing unit 20.

[0050] The computing unit comprises three computers 21, 22 and 23associated with three redundant actuators 11, 12 and 13 in theillustrated example. The computers may each comprise a double structurewith a control channel and a monitoring channel. They establish thecontrol signals from maneuvering commands entered by a pilot on one orseveral control units such as a rudder bar 30. Moreover, the differentcomputers of the central computing unit are preferably of a differentorigin and design in order to prevent a same design fault from beingable to influence all the computers.

[0051] Although this does not appear in the figure, the computers mayreceive commands from a plurality of control units (rudder bar,joystick, etc.) and deliver control signals to actuators of severalmaneuvering units (control surfaces . . . ).

[0052] In the illustrated example, the maneuvering commands are morespecifically delivered to the central computing unit by sensors 31, 32associated with the rudder bar. Moreover, the computing unit receives alarge number of various data, established by sensors which do not appearon the drawing. These data are representative of the parameters andflight conditions of the aircraft, and they enable control signals to beelaborated according to complex computation laws.

[0053] The maneuvering commands of sensors 31, 32 of the rudder bar arealso delivered to an electronic module basically shown with referencenumber 40. The electronic module is capable, like the central computingunit, of establishing control signals for the control surface 10.However, these signals are established by taking into account a smallernumber of parameters and according to simpler computation laws. Inparticular, the control signals may be established according to controlcommands according to a simple proportionality law. It should be notedthat unlike the central computing unit, the backup electronic module maybe provided for establishing the control signals only for onemaneuvering unit. With this feature, the electronic module may belocalized more freely for example, near the actuator(s) controlled bythe module.

[0054] In the example of FIG. 1, the electronic module 40 is onlyconnected with one of the actuators 13 of control surface 10.

[0055]FIGS. 2, 3 and 4 described hereafter show in more detail thestructure of actuators which may be used for deflecting a controlsurface or any maneuvering unit.

[0056] The actuators essentially include a cylinder 50 divided into twochambers 52, 54 by a mobile piston 56. One of the ends of a piston rod58 is mechanically connected to the maneuvering unit (not shown) at ajointed point 60. A second end of the piston rod is connected to aposition sensor 62 used for performing servo-control of position. Theactuator of FIG. 2 has two operating modes selected by a mode slide 64actuated by a solenoid valve 66. In a first position of the mode slide,which is the one illustrated in the figure, both chambers of thecylinder are put into communication in such a way that a hydraulic fluidcontained in the chambers may flow from one chamber to the other througha restrictor. This position corresponds to a so-called passive mode.

[0057] In a second position of the mode slide, chamber 52, 54 of thecylinder are put into communication with a servo-valve 70 whichdistributes a hydraulic fluid into the chambers according to electricalsignals. This position corresponds to a mode called an active mode. Thesignals may be provided to the servo-valve by a computing unit such asthe central computing unit or by an electronic module as mentionedearlier. The same applies to the control signals for the solenoid valve66. For reasons of simplification, the hydraulic power supply of theservo-valve is not illustrated. Moreover, the electrical control inputsof the solenoid valve and of the servo-valve are simply indicated bytwisted arrows.

[0058]FIG. 3 shows an actuator which may operate according to threemodes, corresponding to the three positions of the mode slider 64. Tofacilitate the description of FIG. 3, the portions of this figure whichare identical, similar or equivalent to those of FIG. 2, are marked withthe same reference numbers. Therefore, it is possible to refer to thepreceding description of these portions. The mode slide 64 alwayscomprises a passive mode position wherein chambers 52, 54 of thecylinder are put into communication. It further comprises two positionscorresponding to active modes. In a first active mode position, thechambers of the cylinder are put into communication with a firstservo-valve 70 a. In a second active mode position, the chambers of thecylinder are put into communication with a second servo-valve 70 b. Itis also observed that the mode slide is controlled by two solenoidvalves 66 a and 66 b.

[0059] The first servo-valve 70 a and the first solenoid valve 66 areceive electrical signals from the central computing unit, whereas thesecond servo-valve 70 b and the second solenoid valve 66 b receiveelectrical signals from the backup electronic module. A solenoid valvecontrol hierarchy is provided and specified later on in the text.

[0060] It is further observed that the position sensor is a doublesensor with two portions 62 a and 62 b for providing positionservo-control data to the central computing unit and to the electronicmodule, respectively.

[0061]FIG. 4, which also repeats the same reference numbers for theportions identical with or similar to those of the preceding figures,shows a third actuator structure, which may also receive control signalsfrom two different sources, but which has only one mode slide 64 withtwo positions. Both positions correspond to the passive and activemodes. On the other hand, the servo-valve 70 and the solenoid valve 66are of the double winding type respectively. In this case, both windingsare insulated from each other, and each winding is connected with one ofthe sources of control signals, respectively, i.e., the centralcomputing unit and the backup module. Both portions 62 a, 62 b of theposition sensor may also be two distinct and electrically insulatedwindings.

[0062]FIG. 5, described hereafter, shows in a more detailed way theoperation of the backup electronic module 40. The core of the electronicmodule 40 is formed by a so-called local computing unit 80, provided forelaborating backup control signals according to a simple proportionalitylaw. It is connected to the sensor 32 of the rudder bar (or any othermaneuvering unit), via a unit 82 for reading out maneuvering commands.Accessorily, the local computing unit 80 may also receive data from agyroscopic sensor or an accelerometer. These sensors are symbolicallyreferred to with reference number 84.

[0063] The output of the local computing unit 80, is directed to a mixer86 which corrects the signal according to the current position of thecontrol surface given by the position sensor 62 b of the actuator, andwhich delivers the servo-control signals, for the actuator 13. Referencenumber 88 refers to a control surface position readout device. Thereadout device 88 is connected between the position sensor 62 a, 62 b,and the mixer 86.

[0064] The readout device 88 is also connected to a conversational unit90 provided for exchanging data between the central computing unit 20and the backup electronic module 40. The conversational unit 90 isconnected to the central computing unit 20 by a galvanic insulationmeans 92 such as an optocoupler, for example. It transmits to thecentral computing unit and more specifically to one of the computers 23of this unit, the position data delivered by the sensor 62 b mentionedabove, but also the control signals elaborated by the local computingunit 80, and/or from the mixer 86 in order to provide monitoring of theelectronic module by the central computing unit. The central computingunit may permanently or periodically checked for proper operation of thebackup electronic module 40. With a switch 94 driven by the computer 23assigned to the monitoring of the module, the control signals producedby the module 40 may be isolated or transmitted to the actuator 13.

[0065] During normal operation, i.e. in the described example, when allthe computers of the central computing unit 20 are not out of order,switch 94 is kept open so that the actuator 13, and more specificallythe servo-valve 70, only receive control signals from the centralcomputing unit.

[0066] In this case, the mode slide 64 may either be in a passiveoperating mode wherein the chambers of the cylinder are put intocommunication, or an active mode. As a reminder here, proper operationof the computers of the central computing unit is self-monitored by thecomputing unit itself, owing to the duplex type structure of thecomputers.

[0067] On the other hand, when all the computers of the centralcomputing unit fail, switch 94 is no longer kept open. Upon closing, itprovides direct transmission of the control signals established by thebackup electronic module towards the actuator 13.

[0068] It may be observed in FIG. 5 that switch 94 is also connected tothe solenoid valve of the actuator for controlling its operating mode. Avoltage (28 V) is applied to the solenoid valve 66 in order to put themode slide 64 into the active mode.

[0069] In order to prevent a simultaneous failure of the centralcomputing unit 20 and of the backup electronic module 40 because oftheir power supply being cut off, these components are preferablypowered from different and independent power sources. The centralcomputing unit 20 is powered by one source of electrical power and inthis case it is the electrical power supply circuit of the aircraft. Thebackup electronic module 40 is powered by a power source of hydraulicorigin, i.e., from a hydraulic circuit 100 of the aircraft. A converter102 is provided for converting the hydraulic power supplied by circuit100 into electrical power which may be used by the module.

[0070] With a solenoid valve 104 driven by the central computing unit20, and more specifically by computers 21, 22 not assigned to themonitoring of the electronic module, the hydraulic fluid supply for theconverter 102 may be switched off and the electronic module maytherefore be disabled.

[0071] The electronic module may thus be driven, for example in thefollowing way:

[0072] When the backup electronic module fails, i.e., when it transmitscontrol signals considered to be faulty or when it does not transmit anysignals, the failure is detected by computer 23 assigned to themonitoring of the module and this computer controls, via the two othercomputers 21, 22, the cutting-off of the power supply of the module;

[0073] when all the computers of the central unit fail, the backupmodule 40 is enabled (this point was examined earlier) and

[0074] when the monitoring computer 23 fails and therefore no longerprovides the checking for proper operation of the backup module 40, theother computers of the central computing unit also cut off the powersupply of the backup electronic module.

[0075] It should be specified that the links existing between thedifferent portions described with reference to FIG. 5 may be electricallinks or optical links and that these links are totally segregated,i.e., independent and isolated from each other.

[0076] Finally, as the power supply solenoid valve 104 is controlled bytwo of the computers whereas the third computer controls the signaltransmission switch 94, each computer of the central computing unit havethe possibility of operazing or forbidding the use of the backupelectronic module.

[0077]FIG. 6, described hereafter, shows another possible embodiment ofthe control device. Because of a large number of similarities betweenthe components of FIG. 5 and those of FIG. 6, the description of thesecomponents is not repeated here.

[0078] Unlike FIG. 5, it is noted that in FIG. 6 the actuator is nolonger of the type of the one described with reference to FIG. 4 but ofthe type described with reference to FIG. 2. In other words, theactuator only has a single electrical control input both for theservo-valve 70 and the solenoid valve 66. Moreover, the actuator is onlyconnected to the backup electronic module 40, without any direct linkwith the central computing unit 20. On the other hand, theconversational unit 90 is designed not only for allowing a transfer ofdata from the backup module 40 to the central computing unit 20, butalso for receiving from the central computing unit, control signals forthe actuator. Thus, the control signals established by the centralcomputing unit are not forwarded to the actuator directly but throughthe electronic module. Such an embodiment is particularly suitable whenthe electronic module is positioned near the actuator or is integratedinto the latter.

[0079] An additional switch 95, given by the computer 23, assigned tothe monitoring of the backup electronic module, enables control signalsestablished by the central computing unit 20 or those established by thelocal computer 80 of the electronic module to be directed towards theactuator.

[0080] In the case of a failure of the central computing unit, theadditional switch 95 is no longer energized and automatically directsthe signals established by the local computer 81 towards the actuator.

[0081]FIG. 7 shows a control device in accordance with FIG. 6 used forcontrolling a rudder. The components of this figure, are substantiallythe same as those of FIG. 1 and are marked with the same referencenumbers. FIG. 7 shows that two of the actuators are exclusively reservedfor being controlled by the central computing unit. These are actuators11 and 12, whereas the third actuator 13 a is only driven by the backupelectronic module 40. An architecture in accordance with FIG. 7 does notprevent any permanent or occasional check for proper operation of thebackup electronic module, as described earlier. However, when the backupmodule control signals are not sent to the actuator 13 a, the latter isplaced in passive mode.

[0082]FIG. 8, as described hereafter, illustrates another possibleapplication of a control device according to the invention. The deviceof FIG. 8 relates to a braking mechanism and in particular to a brakingmechanism for an aircraft.

[0083] On an aircraft, brakes may be applied to each wheel or wheeltrain individually and the latter may include several braking devices.In the described example, the braking mechanism includes two devicesmarked with reference numbers 200 a and 200 b, respectively. Eachbraking device includes at least one shoe 202 a, 202 b capable ofapplying a first set of discs, so-called “stator” discs, integral withthe leg of the landing gear, against a second set of discs, so-called“rotor” discs, integral with the rotating wheel(s) R.

[0084] Furthermore, the braking devices each include a valve 204 a, 204b connected to hydraulic circuits 206 a, 206 b, respectively, forexerting a braking force on the shoes via pistons not shown. The valvesare connected to hydraulic circuits via a solenoid valve 208 a, 208 b,respectively capable of cutting off the hydraulic pressure in the caseof a failure or a leak. For example the valves are of the servo-valvetype or with direct control (DDV/Direct Drive Valve).

[0085] Control of the braking devices 200 a and 200 b of FIG. 8 isprovided by a computing unit 220, comparable to the central computingunit of the applications described earlier, and by a backup electronicmodule 240, respectively.

[0086] The computing unit 220 and the backup module 240 are connected tobraking and deflection command sensors 231, 232, of a control unit 230(brake pedals), for receiving braking or deflection control commands.From these commands, they elaborate control signals essentially for thevalves but also for the solenoid valves.

[0087] The signals elaborated by the backup electronic module 240 mayfurther result from a simple proportionality computation law. On theother hand, the signals elaborated by the computing unit 220 may satisfya more sophisticated computation law, taking into account for example,tachometric data provided by a sensor 284 detecting the rotational speedof the wheels. These data enable control signals to be established withan anti-skid function for the wheels.

[0088] A connection 292 is used for exchanging data between thecomputing unit 220 and the backup electronic module 240 and inparticular for performing the monitoring of proper operation of thebackup module by means of the computing unit 220. However, the computingunit 220 includes several computers, or at the very least, computerswith self-contained control and monitoring channels in order to performits own control of operation, according to the invention.

[0089] In operation, only the control signals provided by the computingunit 220 are transmitted to the valve 204 a of the first braking device.In the case of a failure of the “normal” control, and in particular inthe case of a fault in the computing unit 220, the solenoid valve is nolonger energized and depressurizes the first braking device 200 a.

[0090] Depressurization is then detected by a pressure sensor 210 a ofthe first braking device and the electronic module connected to thissensor transmits its control signals to the second braking device 200 b.

[0091] In the case of a fault in the backup electronic module, thecomputing unit 220 signals the failure to the flight crew, keeps controland consequently prevents the second braking device from starting tooperate.

[0092] A pressure sensor 210 b is connected to the computing unit 220and is used for detecting proper operation of the backup line during atest sequence before landing. This test sequence may be controlled bythe computing unit 220 through the link 292.

1. A device for controlling maneuvering units of an aircraft including:at least one control unit (30, 230) which may be actuated by a pilot forissuing maneuvering commands, at least one central computing unit (20,220) capable of establishing control signals for at least onemaneuvering unit (10, R) from said maneuvering commands, each centralcomputing unit being provided with its own failure detection system,characterized in that it further includes at least one backup electronicmodule (40, 240), associated with at least one maneuvering unit, andcapable of also establishing control signals for said maneuvering unitfrom said maneuvering commands, said electronic module lacking anyfailure detection system of its own, but being connected to a centralfailure detection system.
 2. The device according to claim 1, whereinthe central computing unit is capable of establishing control signalsfor a plurality of maneuvering units (10).
 3. The device according toclaim 2, wherein the central failure detection system is a computer (23)of the central computing unit (20).
 4. The device according to claim 1,wherein the central computing unit (20) is programmed in order toestablish control signals according to a law, called an elaborate law,and wherein each electronic module (40) is programmed according to atleast one law, a so-called simplified law, different from the elaboratelaw.
 5. The device according to claim 4, wherein the simplified law is aproportional type law.
 6. The device according to claim 1, wherein thecentral computing unit (20) includes at least two redundant computers(21, 22, 23) the redundant computers being of a different design andorigin.
 7. The device according to claim 1, wherein the centralcomputing unit (20) includes at least one computer with a duplex typestructure, equipped with a first computing channel called a controlchannel and with a second computing channel called a monitoring channel,the monitoring channel being part of the actual failure detectionsystem.
 8. The device according to claim 1, wherein the centralcomputing unit (20) is connected to maneuvering units via electronicmodules (40).
 9. The device according to claim 3, wherein eachelectronic module (40) is connected to the central computing unit viagalvanic insulation means (92).
 10. The device according to claim 1,wherein the central computing unit (20) and the backup electronicmodules (40) are connected to distinct and self-contained electricalpower supply sources.
 11. The use of a device according to any of thepreceding claims, for controlling at least one maneuvering unit selectedfrom: a control surface of the aircraft, an adjustable inclined plane ofthe aircraft, and a braking mechanism of the aircraft.
 12. A method forcontrolling maneuvering units of an aircraft consisting of: establishingfirst control signals of a plurality of maneuvering units by means of atleast one central computing unit (20, 220) provided with its own failuredetection system, establishing second control signal by means of aplurality of backup electronic modules (40, 240) respectively associatedwith the plurality of maneuvering units, checking for proper operationof at least one computer of the central computing unit (20, 220) andforwarding of the first control signals to the maneuvering units whenproper operation is ascertained, and forwarding of the second controlsignals to the maneuvering units associated with the electronic modules,respectively when a malfunction is ascertained.
 13. The method accordingto claim 12, further comprising the checking for proper operation of theelectronic modules (40, 240) by means of the central computing unit (20,220).
 14. The method according to claim 13, wherein the checking forproper operation is performed by a single computer (23) selected fromseveral computers of the central computing unit (20).
 15. The methodaccording to claim 13, wherein the checking for proper operation isperformed continuously.
 16. The method according to claim 13, whereinthe checking for proper operation is performed periodically.